My Site Shows 'Deceptive Site Ahead': How to Remove the Red Warning Screen

If Chrome shows people visiting your site a red screen saying 'Deceptive site ahead' or 'The site ahead contains malware', Google Safe Browsing has found a phishing page, malware or an unwanted download on your site. The warning doesn't go away on its own. To remove it, find which pages were flagged in Search Console's Security issues report, clean the site, and request a review from the same report. If the cleanup is done right, phishing warnings usually clear within about a day and malware warnings within a few days.

This warning drives your traffic to nearly zero. Very few visitors continue past a red screen, and the warning can also appear in Google search results. You need to move quickly, but without rushing.

Confirm the warning

First make sure the warning really concerns your site:

• Enter your domain on the Safe Browsing site status page of Google's Transparency Report. It shows whether the site is currently flagged as unsafe and why.
• Open the 'Security issues' report under 'Security & Manual Actions' in Search Console. You'll see the type of issue and sample URLs there.
• If the warning appears only in Microsoft Edge or in an antivirus program, the source isn't Google but Microsoft SmartScreen or that antivirus vendor. You'll need to send them a review request separately.

If Search Console isn't set up, set it up now and verify your domain; review requests can only be sent from there. Setting up Search Console takes half an hour.

Which issue does the report show?

The most common types in the Security issues report:

• Social engineering (deceptive pages). Your site hosts a fake login page imitating a bank, courier or email provider. Attackers usually hide these in subfolders; your home page looks normal.
• Malware. Your site tries to download a harmful file to the visitor's device, or redirects them to a site that does.
• Hacked content. Spam pages or hidden links have been added to your site. This type usually leads not to a red screen but to a 'This site may be hacked' note in search results. Japanese spam is the most common example; we cover it separately in cleaning up Japanese spam.
• Harmful downloads or unwanted software. A file you host (an old program installer, for example) has been flagged as harmful.

Note the sample URLs in the report. The cleanup starts there.

Find the source

Sending a review request before removing what the attacker planted leads to rejection and a longer process. Checklist:

• Open the sample URLs with Search Console's URL Inspection rather than in your browser. Some malicious pages are shown only to certain visitors.
• In the hosting file manager, look for files changed or added in recent days. Phishing pages are usually inside wp-content, uploads or a folder with a meaningless name, as an HTML or PHP file alongside an images folder.
• Review the third-party code on your site: ad codes, chat widgets, an old visitor counter, or a JavaScript file loaded from a domain whose owner has let it lapse. A compromised external script can make your site look malicious without any change to your own files.
• Check the admin user list for accounts you don't recognise.

If your host has a malware scanner, run it and ask for the results. For the general response order, follow the steps in your site got hacked: the first 24 hours.

Clean up and close the door

Delete the phishing folder or malicious files, replace modified files with clean copies, and remove external code of unclear origin. Then close the door the attacker came through: update all software and plugins, delete unused ones, and change every password.

Restoring from a backup you're sure is clean is also an option. But if you restore without closing the hole, the same phishing page returns within days and the second review takes longer.

Request a review

In Search Console's Security issues report, tick 'I have fixed these issues' and press 'Request Review'. Keep the explanation short and specific:

• What you found (for example, a fake bank login page in the uploads folder).
• What you did (deleted the files, updated the plugin, changed passwords).
• What you did to prevent it happening again.

According to Google, phishing reviews usually take about a day, malware reviews a few days, and reviews for sites hacked with spam can take several weeks. When the review succeeds, the warning disappears from Chrome and search results; because of browser caching, some visitors may see it for a few more hours.

If the request is rejected, look at the sample URLs in the email again; there's usually a file that was missed.

If the warning is unfair

False alarms happen, though rarely. For example, your site may contain a legitimate login form that resembles a phishing page, or the flagged file may actually be harmless. The path is the same: explain in the review request why it's harmless. For warnings in Microsoft Edge, also report the false positive through Microsoft's site reporting form.

Making sure it doesn't happen again

Phishing pages mostly get in through outdated plugins and weak passwords. Apply the list in website security measures and make sure Search Console email notifications are on. When Google finds a security issue, that's where it tells you first.

Keeping on top of updates, security checks and backups is what our maintenance and support plan is for. If your site is opening with a red screen right now, write to us; let's find the source first, then do the cleanup and review request together.